Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add kinhluan/rules-quarkus-skills --skill code-reviewergit clone --depth 1 https://github.com/kinhluan/rules-quarkus-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/kinhluan/rules-quarkus-skills/code-reviewer)<a href="https://agentmods.dev/skills/kinhluan/rules-quarkus-skills/code-reviewer"><img src="https://agentmods.dev/badge/skills/kinhluan/rules-quarkus-skills/code-reviewer/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/kinhluan/rules-quarkus-skills/code-reviewer"><img src="https://agentmods.dev/badge/skills/kinhluan/rules-quarkus-skills/code-reviewer.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00027 | $0.01101 |
| Opus 5 | $0.00014 | $0.00550 |
| Sonnet 5 | $0.00005 | $0.00220 |
| Haiku 4.5 | $0.00003 | $0.00110 |
Grade A, and why
code-reviewer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 76 lines — stays where its author put it; the contents beside it link to each section on GitHub.
code-reviewer 🔍
Keyword: reviewer | Platforms: gemini,claude,codex
Expert AI Agent Skill for Code Reviewing - Standards and practices for reviewing code effectively based on Google's Engineering Practices.
🎯 Core Mandates (The Reviewer's Rules)
- Preflight Check: Always check if the code compiles and passes basic linting before starting the deep review. If it fails, reject immediately with the error logs.
- The Standard for Approval: Approve a CL if it is a net improvement, even if it's not perfect. Don't block for minor preferences.
- Speed is Critical: Respond to code reviews within one business day.
- Mentorship Mindset: Explain WHY you're requesting a change. Aim to teach the author.
- 7 Pillars of Review: Conduct a holistic review based on:
- Correctness: Does the logic actually work?
- Readability: Is it easy to understand for future maintainers?
- Maintainability: Does it avoid technical debt and duplication?
- Efficiency: Are there obvious performance bottlenecks?
- Security: Does it introduce vulnerabilities (logging secrets, SQL injection)?
- Edge Cases: Does it handle
null, empty inputs, and failures? - Testability: Is the logic covered by unit tests that actually fail when logic is broken?
🛠 Reviewing Workflows
1. Preflight & High-Level View
- Check compilation (
mvn compile,bazel build). - Review the CL description. Is the intent clear? Are the "Risk Areas" called out?
- Look for major architectural flaws first. Stop and discuss before nitpicking.
2. Deep Dive & Adversarial Logic Tracing
Use these "Adversarial" techniques to find hidden bugs:
- The "What-If" Tracing: "Assume line X returns
nullor an empty list. Trace the execution path. Does it fail gracefully?" - The "Boundary" Analysis: "Check all comparison operators (>, <, ==). Verify if 'off-by-one' errors are possible."
- The "Inversion" Check: "Can you find a sequence of inputs that would enter an infinite loop or cause a race condition?"
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 76 lines · 27 tokens per session scan A de437d7edd37
code-reviewer is a skill published in the GitHub repository kinhluan/rules-quarkus-skills (3 stars, last pushed 3mo ago), licensed MIT. It adds 27 tokens to every session and 1,101 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
spec-kitty-mission-review
Review a fully merged Spec Kitty mission post-merge (all WPs done/approved) to verify spec→code fidelity, FR coverage, drift, risks, and security. Triggers: "review the merged mission", "post-merge mission review", "verify the completed mission", "audit the mission implementation", "mission-level acceptance review"…
spec-kitty-runtime-review
Review runtime-owned outputs using the Spec Kitty review workflow surface, then direct approval or rejection with structured feedback. Triggers: "review this work package", "check runtime output", "approve this step", "review WP", "is this WP ready to approve", "check this implementation". Does NOT handle: setup-only…
simplify
This skill should be used when the user asks to "simplify", "clean up the diff", "run simplify", "simplify the changes", "review changed code for cleanup", explicitly invokes "/simplify", or asks to "commit without simplify", "skip simplify for this commit", or "commit this but skip simplify". Reviews changed code…
adversarial-squad
Deploy a bounded, profile-loaded adversarial review squad at an SDD point-cut (post-spec, post-plan, post-tasks, pre-merge, or an ad-hoc decision) so independent doctrine lenses converge on findings one reviewer would miss. Triggers: "deploy a squad", "adversarial squad", "post-tasks anti-laziness pass", "pre-spec…
spk-gate-accept
Run the Spec Kitty accept gate for a completed mission and verify final readiness before merge.
resolve-pr-comments
This skill should be used when user asks to "address PR comments", "resolve PR feedback", "handle review comments", "fix PR issues", "respond to PR review", or explicitly invokes "resolve-pr-comments".